CVE-2025-63601

The vulnerability results from insufficient validation of uploaded backup files (CWE-434 — unrestricted upload of file with dangerous type). An authenticated attacker uploads a malicious backup file containing arbitrary files that, after processing by the application, are placed on the server. Subsequently, the attacker is able to execute arbitrary system commands in the context of the application server process. The attack vector is network-based, requires no victim interaction, and does not require high privileges (a regular user account is sufficient).

An attacker can gain full control of the server, including access to sensitive data (C:H), modification or deletion of data (I:H), and prevention of system operation (A:H). Due to the changed scope (S:C), the impact may extend beyond the Snipe-IT application itself and include other systems in the environment.

Snipe-IT should be immediately updated to version 8.3.3 or later, available at: https://github.com/grokability/snipe-it/releases/tag/v8.3.3. The fix was introduced as part of pull request #17966 in the official project repository.

Snipe-IT (Snipeitapp Snipe-IT) in all versions before 8.3.3